All Versions
135
Latest Version
Avg Release Cycle
47 days
Latest Release
235 days ago

Changelog History
Page 5

  • v3.6.2 Changes

    May 19, 2017
    • 🖐 Handle safe call operator in checks
    • 👍 Better handling of if expressions in HAML rendering
    • ✂ Remove --rake option
    • Properly handle template names without .html or .js
    • 👍 Set template file names during rendering for better errors
    • Limit Slim dependency to before 3.0.8
    • 📜 Catch YAML parsing errors in session settings check
    • ⚠ Avoid warning about SQLi with to_s in exists?
    • ⚡️ Update RubyParser to 3.9.0
    • 0️⃣ Do not honor additional check paths in config by default
    • 🖐 Handle empty if expressions when finding return values
    • 🛠 Fix finding return value from empty if

  • v3.6.1 Changes

    March 24, 2017
    • 🛠 Fix error when using --compare (Sean Gransee)

  • v3.6.0 Changes

    March 23, 2017
    • Avoid recursive Concerns
    • Branch inside of case expressions
    • 🖨 Print command line option errors without modification
    • 🛠 Fix issue with nested interpolation inside SQL strings
    • Ignore GraphQL tags inside ERB templates
    • ➕ Add --exit-on-error (Michael Grosser)
    • Only report CVE-2015-3227 when exact version is known
    • Check targetless SQL calls outside of known models

  • v3.5.0 Changes

    February 01, 2017
    • 👍 Allow -t None
    • Fail on invalid checks specified by -x or -t
    • ⚠ Avoid warning about all, first, or last after Rails 4.0
    • ⚠ Avoid warning about models in SQLi
    • Lower confidence of SQLi when maybe not on models
    • Warn about SQLi even potentially on non-models
    • Report check name in JSON and plain reports
    • Treat templates without .html as HTML anyway
    • ➕ Add --ensure-latest option (tamgrosser / Michael Grosser)
    • ➕ Add --no-summary to hide summaries in HTML/text reports
    • 🖐 Handle included block in concerns
    • 🖨 Process concerns before controllers

  • v3.4.1 Changes

    November 02, 2016
    • 👉 Show action help at start of interactive ignore
    • Check CSRF setting in direct subclasses of ActionController::Base (Jason Yeo)
    • 🔧 Configurable engines path (Jason Yeo)
    • 💎 Use Ruby version to turn off SymbolDoS check
    • 💎 Pull Ruby version from .ruby-version or Gemfile
    • Avoid warning about where_values_hash in SQLi
    • 🛠 Fix ignoring link interpolation not at beginning of string

  • v3.4.0 Changes

    September 08, 2016
    • ➕ Add new plain report format
    • ➕ Add option to prune ignore file with -I
    • 👌 Improved Slim template support
    • 👉 Show obsolete ignore entries in reports (Jonathan Cheatham)
    • 👌 Support creating reports in non-existent paths
    • ➕ Add --no-exit-warn

  • v3.3.5 Changes

    August 12, 2016
    • 🛠 Fix bug in reports when using --debug option

  • v3.3.4 Changes

    August 12, 2016
    • ➕ Add generic warning for CVE-2016-6316
    • Warn about dangerous use of content_tag with CVE-2016-6316
    • ➕ Add warning for CVE-2016-6317
    • ✅ Use Minitest

  • v3.3.3 Changes

    July 21, 2016
    • 🚅 Show path when no Rails app found (Neil Matatall)
    • Index calls in view helpers
    • 🖨 Process inline template renders
    • ⚠ Avoid warning about hashes in link_to hrefs
    • ➕ Add documentation for authentication category
    • Ignore boolean methods in render paths
    • ⬇️ Reduce open redirect duplicates
    • 🛠 Fix SymbolDoS error with unknown Rails version
    • Sexp#value returns nil when there is no value
    • 👌 Improve return value estimation

  • v3.3.2 Changes

    June 10, 2016
    • 🛠 Fix serious performance regression with global constant tracking